WordPress plugin WP Roles at Registration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

GHSA-CXWF-QC32-375F Decidim-Awesome has SQL injection in AdminAccountability

Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component:...

MAL-2024-10616 Malicious code in ethers-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 058ac1d6271bf68f9476a6f0a9e4df3a4764f5a06405e90fcac87968f2a9608d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ext4: fix slab-use-after-free in ext4_split_extent_at()

...

Canadian Man Arrested in Snowflake Data Extortions

A 25-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service Snowflake. Image: https://www.pomerium.com/blog/the-real-lessons-from-the-snowflake-breach On October 30, Canadian authorities arrested...

REST-APIs unintentionally enabled in Century Systems FutureNet NXR series routers

Overview FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial factory default configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server GUI or Web...

Snowflake Connector for Python 日志信息泄露漏洞

Snowflake Connector for Python is an open source interface from Snowflake Computing. It is used to develop Python applications that can connect to Snowflake and perform all standard operations. A logging information disclosure vulnerability exists in Snowflake Connector for Python versions prior ...

CVE-2024-48440

The CVE-2024-48440 entry affects Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA (RG500UEAABxCOMSLICv3.2.2543.12.18) and is caused by a command injection vulnerability in the at_command.asp component. Public data lists CVSSv3.1 metrics: AV Adjacent, AC Low, PR None, UI None,...

SUSE CVE-2024-47684

In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcprtodeltaus We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcprearmrto. Initially hittin...

MAL-2024-9368 Malicious code in fuh0qz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7529bc6b4e017a1268dff08f21236c040484c75d1c87e3bbe413b7c1afea0ef6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9346 Malicious code in dhwmfs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d7732d14f5f18b93b76e0b9164667441919050e960414ac343c60a460854803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9365 Malicious code in file-alb-um-zip-new-mp3-126009-bitter-sweet-dz7i2-hidryu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a75501436f2395e00123299cf864bf5850d07617243e0205e60c4d3843110c26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals

The US has accused two brothers of being part of the hacker group Anonymous Sudan, which allegedly went on a wild cyberattack spree that hit hundreds of targets—and, for one of the two men, even put lives at risk...

MAL-2024-9292 Malicious code in discord.jselfbot-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a61c990eea82ae2bbc613649aabde4884684f69fa4b649655cbee9e1e5018293 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

China’s Salt Typhoon Hacks AT&T and Verizon, Accessing Wiretap Data: Report

China’s Salt Typhoon hacked AT&T, Verizon, and Lumen, compromising wiretap systems used in criminal investigations. The breach, linked…...

MAL-2024-8917 Malicious code in ibm-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d299d0b8d9bf7cc9c318e385566c4f1c9c972374224f38ac12d8fb90612dbdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8864 Malicious code in create-auction-house (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2211dcc1cfcd557e8c971ec03d126ef506517e91d0037f89be0bfb34265f0b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROS-20240910-06

A vulnerability in the Zabbix universal monitoring system is related to improper code generation controls. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code Zabbix universal monitoring system vulnerability is related to the ability to directly...

MAL-2024-8774 Malicious code in hwpoepr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a002fd18d59f61bbe4732ac672a1deff9f0ba2f80a77258d0b25922390c3695 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45394 Secret encryption vulnerable to brute-force attacks

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVPBytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the...